3 ms·

There is no need to implement an ad-blocker as a VPN. It provides a strictly worse experience than implementing one via DNS APIs (as Blokada have done). The on

There is no need to implement an ad-blocker as a VPN. It provides a strictly worse experience than implementing one via DNS APIs (as Blokada have done). The only reason one may wish to implement as a VPN instead is to get a lot of data about users to sell. They otherwise provide less control, use more battery, are less reliable, and have privacy issues. iOS even provides some good APIs for this that apps can hook into so that they don't need to deal with networking at all. Much faster, and the app receives no data about network usage. Edit: Misunderstood Blokada's comment, they use DNS to do their filtering now.

wollsmoth 4y ago
yeah nextdns has been working just fine for me.
- danpalmer 4y ago
  I'm glad to hear, although even DNS level is somewhat unnecessary.
  - camhart 4y ago
    How else would you block ads?
    - danpalmer 4y ago
      Apologies, I misread the Blokada comment as implying there was another mechanism – I don't know what they mean by "cloud filtering". iOS provides APIs to do content filtering at the system level, I assumed they were referring to something similar.
  - wollsmoth 4y ago
    seems like it's harder for sites to detect. For a while I was seeing a lot of "disable your ad blocker" messages, now I just don't, and the ads don't load.
codedokode 4y ago
Does content-blocking API works for apps? Or only for browser?
counttheforks 4y ago
Do you have a link to the content blocking APIs to integrate with arbitrary apps? For example, random game apps which show in app ads. VPN adblockers can block the ads there. How do I use a content blocking api to do this?
untitaker_ 4y ago
Which content-blocking APIs are you talking about? Blockada just started hosting a DNS server. Google just made it so that blocking decisions can't be made locally anymore and all my used domain names are sent to a third-party server. Given deployment of SSL and even cert pinning in almost all apps I know of, I doubt the local VPN API allowed them to gather much more info than hostnames either. EDIT: I see you're affiliated with Google Play. You should've lead with that.
camhart 4y ago
This is false. Blokada uses the Private DNS feature of the phone to block ads. That feature is only available as of Android 9. Any device running Android 8 or lower doesn't have access to it. I don't believe there is a "content-blocking api". Correct me if I'm wrong. Using a VPN could technically allow an ad blocker to block based on the full http path instead of blocking based on domain name. It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't.
- danpalmer 4y ago
  > Blokada uses the Private DNS feature of the phone to block ads Oh, good, I had interpreted "Cloud filtering" as some sort of content blocking API. DNS makes sense. > It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't. That's good if VPN apps aren't always actually implementing a VPN, and it likely eliminates the battery life issue, but the confusion is a problem as users can't tell the difference between an actual VPN and one that is only doing DNS stuff. In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me?
  - camhart 4y ago
    > In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me? I could be mistaken here, but I believe it's only dangerous if you're using an insecure connection (ie, http (no https) which is already dangerous). Or if you install a custom CA certificate--then the VPN could perform man in the middle attacks on your connection.
xigoi 4y ago
Blokada does use the VPN functionality…
kenniskrag 4y ago
I use firefox with ublock. But that works only for browsing.
jeroenhd 4y ago
Android has no system-wide content blocking APIs. Furthermore, Google's policy specifically states that VPNs may not "Manipulate ads that can impact apps monetization", proving that this is not about VPNs, but about ad blocking in general. My solution is a WireGuard VPN to my home network (which is behind PiHole) but a local solution cannot properly block network requests without the VPN API. Blokada has switched to doing DNS-based blocking through DNS but that's purely to get around Google's arbitrary restrictions on the VPN API. Users should be able to use whatever network filters they like. If I don't want to send ICMP packets, or DNS packets for certain servers, or any other kind of specific traffic, I should have control over what my device is doing. Note that the VPN API does not necessitate actually setting up a VPN to a cloud server. The VPN API exposes packets to an Android app so it can decide whether or not to forward the packet, rewrite it, send it through a tunnel, etc. Normally, there is no cloud service when VPN ad blockers are in use. Blokada has switched to a cloud system but only after Google blocked their normal system. Until Google releases a comprehensive network filter driver API or firewall API there is simply no alternative. The Blokada local DNS server solves one problem (the need for a VPN) but cannot prevent ad libraries from using DoH to work around content blockers.
tgtweak 4y ago
VPN blocks it on all apps, but generally speaking I agree it's better to do this in this order, where possible: In-app (browser, css aware) In-dns (local resolver) In-network (pihole or IP firewall) Ex-Network (vpn/proxy) Since the first option has very sparse universal support (and shrinking) - you need to rely on the less savoury options to achieve proper adblocking.
whimsicalism 4y ago
You should disclose your affiliations in this case.
pmontra 4y ago
Blockada 5's VPN runs entirely on the phone. No problems with battery usage. Using their DNS with Blockada 6? No thank you. I'm saving the APK and I will sideload it for as long as it will work. The problem is the maintenance of the blacklist. Anyway, a lot of people are interested in blocking ads, a solution will be found. Is already there an open source app equivalent to Blockada?

wollsmoth 4y ago

yeah nextdns has been working just fine for me.

danpalmer 4y ago
I'm glad to hear, although even DNS level is somewhat unnecessary.
- camhart 4y ago
  How else would you block ads?
  - danpalmer 4y ago
    Apologies, I misread the Blokada comment as implying there was another mechanism – I don't know what they mean by "cloud filtering". iOS provides APIs to do content filtering at the system level, I assumed they were referring to something similar.
- wollsmoth 4y ago
  seems like it's harder for sites to detect. For a while I was seeing a lot of "disable your ad blocker" messages, now I just don't, and the ads don't load.

codedokode 4y ago

Does content-blocking API works for apps? Or only for browser?

counttheforks 4y ago

Do you have a link to the content blocking APIs to integrate with arbitrary apps? For example, random game apps which show in app ads. VPN adblockers can block the ads there. How do I use a content blocking api to do this?

untitaker_ 4y ago

Which content-blocking APIs are you talking about? Blockada just started hosting a DNS server. Google just made it so that blocking decisions can't be made locally anymore and all my used domain names are sent to a third-party server. Given deployment of SSL and even cert pinning in almost all apps I know of, I doubt the local VPN API allowed them to gather much more info than hostnames either. EDIT: I see you're affiliated with Google Play. You should've lead with that.

camhart 4y ago

This is false. Blokada uses the Private DNS feature of the phone to block ads. That feature is only available as of Android 9. Any device running Android 8 or lower doesn't have access to it. I don't believe there is a "content-blocking api". Correct me if I'm wrong. Using a VPN could technically allow an ad blocker to block based on the full http path instead of blocking based on domain name. It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't.

danpalmer 4y ago
> Blokada uses the Private DNS feature of the phone to block ads Oh, good, I had interpreted "Cloud filtering" as some sort of content blocking API. DNS makes sense. > It should also be noted that you can use the VPNService in android to only set a DNS server to use, without actually sending any traffic through a VPN. Using the VPNService in this way is not going to be allowed with the new Developer Policy update. When used this way, the privacy issues aren't there--though there is the potential misunderstanding of end users who might think they are using a full VPN when in reality they aren't. That's good if VPN apps aren't always actually implementing a VPN, and it likely eliminates the battery life issue, but the confusion is a problem as users can't tell the difference between an actual VPN and one that is only doing DNS stuff. In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me?
- camhart 4y ago
  > In fact an app could say "don't worry we're only doing DNS" but actually be a VPN. That sounds dangerous to me? I could be mistaken here, but I believe it's only dangerous if you're using an insecure connection (ie, http (no https) which is already dangerous). Or if you install a custom CA certificate--then the VPN could perform man in the middle attacks on your connection.

xigoi 4y ago

Blokada does use the VPN functionality…

kenniskrag 4y ago

I use firefox with ublock. But that works only for browsing.

jeroenhd 4y ago

Android has no system-wide content blocking APIs. Furthermore, Google's policy specifically states that VPNs may not "Manipulate ads that can impact apps monetization", proving that this is not about VPNs, but about ad blocking in general. My solution is a WireGuard VPN to my home network (which is behind PiHole) but a local solution cannot properly block network requests without the VPN API. Blokada has switched to doing DNS-based blocking through DNS but that's purely to get around Google's arbitrary restrictions on the VPN API. Users should be able to use whatever network filters they like. If I don't want to send ICMP packets, or DNS packets for certain servers, or any other kind of specific traffic, I should have control over what my device is doing. Note that the VPN API does not necessitate actually setting up a VPN to a cloud server. The VPN API exposes packets to an Android app so it can decide whether or not to forward the packet, rewrite it, send it through a tunnel, etc. Normally, there is no cloud service when VPN ad blockers are in use. Blokada has switched to a cloud system but only after Google blocked their normal system. Until Google releases a comprehensive network filter driver API or firewall API there is simply no alternative. The Blokada local DNS server solves one problem (the need for a VPN) but cannot prevent ad libraries from using DoH to work around content blockers.

tgtweak 4y ago

VPN blocks it on all apps, but generally speaking I agree it's better to do this in this order, where possible: In-app (browser, css aware) In-dns (local resolver) In-network (pihole or IP firewall) Ex-Network (vpn/proxy) Since the first option has very sparse universal support (and shrinking) - you need to rely on the less savoury options to achieve proper adblocking.

whimsicalism 4y ago

You should disclose your affiliations in this case.

pmontra 4y ago

Blockada 5's VPN runs entirely on the phone. No problems with battery usage. Using their DNS with Blockada 6? No thank you. I'm saving the APK and I will sideload it for as long as it will work. The problem is the maintenance of the blacklist. Anyway, a lot of people are interested in blocking ads, a solution will be found. Is already there an open source app equivalent to Blockada?